BIOC
Informational
✕
Disable outlook security via Registry
Attackers may try to disable outlook security features by modifying the Registry.
- Module:
- Platform Analytics
- Agent event type:
- Registry
- Category:
- Tampering
- Status:
- Enabled
ATT&CK tactics: Defense Evasion (TA0005)
ATT&CK techniques: Impair Defenses: Disable or Modify Tools (T1562.001)
Indicator:
Registry registry data = 2 , 3 AND registry value name = PromptOOMSend , AdminSecurityMode , ObjectModelGuard AND registry key name = *Outlook* AND action type = set_registry_value Process initiator signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash , cgo signature = Signed , Unsigned , N/A , Invalid Signature , Weak Hash AND initiator signer != Relativity ODA LLC AND Pearson PLC AND cgo signer != Relativity ODA LLC AND Pearson PLC AND initiated by != svchost.exe AND cgo name != svchost.exe Host host os = windows
Preventable: yes